RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 02:27:43 +00:00
Code Issues Activity Actions

LibWeb: Protect RadioButton and TextNode against mutating DOM

Browse source 
RadioButton had some protection, but also needed to be protected against
click events originating from its associated label.
This commit is contained in:
Timothy Flynn 2021-04-04 11:45:39 -04:00 • committed by Andreas Kling
parent 2199a59614
commit 1380dbeef3
2 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Userland/Libraries/LibWeb/Layout/RadioButton.cpp
View file

@ -115,6 +115,9 @@ void RadioButton::handle_associated_label_mousedown(Badge<Label>)
void RadioButton::handle_associated_label_mouseup(Badge<Label>) void RadioButton::handle_associated_label_mouseup(Badge<Label>)
{ {
// NOTE: Changing the checked state of the DOM node may run arbitrary JS, which could disappear this node.
NonnullRefPtr protect = *this;
set_checked_within_group(); set_checked_within_group();
m_being_pressed = false; m_being_pressed = false;
} }

4
Userland/Libraries/LibWeb/Layout/TextNode.cpp
View file

@ -324,6 +324,10 @@ void TextNode::handle_mouseup(Badge<EventHandler>, const Gfx::IntPoint& position
{ {
if (!parent() || !is<Label>(*parent())) if (!parent() || !is<Label>(*parent()))
return; return;
// NOTE: Changing the state of the DOM node may run arbitrary JS, which could disappear this node.
NonnullRefPtr protect = *this;
downcast<Label>(*parent()).handle_mouseup_on_label({}, position, button); downcast<Label>(*parent()).handle_mouseup_on_label({}, position, button);
frame().event_handler().set_mouse_event_tracking_layout_node(nullptr); frame().event_handler().set_mouse_event_tracking_layout_node(nullptr);
} }